Privacy Notice on Commercial Electronic Message Consent of Paribu Kripto Varlık Anonim Şirketi

**PARİBU KRİPTO VARLIK A.Ş.**PRIVACY NOTICE ON COMMERCIAL ELECTRONIC MESSAGE CONSENT

In accordance with Article 10 of the Personal Data Protection Law No. 6698, titled "Disclosure Obligation of the Data Controller", published in Official Gazette No. 29677 dated 7 April 2016, which aims to protect the fundamental rights and freedoms of individuals — particularly the privacy of personal life — in the processing of personal data, and the Communiqué on Procedures and Principles to Be Followed in Fulfilling the Disclosure Obligation published in Official Gazette No. 30356 dated 10 March 2018, as Paribu Kripto Varlık Alım Satım Platformu A.Ş. (Paribu Crypto Asset Trading Platform Inc.) ("Paribu" or "Company"), we process your personal data within the scope of the Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages. This privacy notice has been prepared to provide information on how we, as the data controller, process your personal data set forth below.

For detailed information on how we protect personal data and the rules with which we comply when processing personal data, you can also review our Personal Data Processing and Protection Policy on our website at www.paribu.com.

A-) What Personal Data of Yours Are Processed?

Within the scope of your relationship with Paribu, the following personal data are processed;

Identity Information: First name, last name.

Contact Information: Email, phone number.

B-) Purposes of Personal Data Processing

Personal data obtained within the scope of your relationship with Paribu are processed for the following purposes;

• Carrying out activities to promote Paribu and the products and services of Paribu and to increase recognition,
• Carrying out marketing, advertising, and promotional activities of Paribu and the products and services of Paribu,
• Conducting interviews to obtain feedback regarding comments/opinions and satisfaction in relation to Paribu and the products and services of Paribu, and the events and campaigns organised by Paribu,
• Within the scope of the data processing purposes set forth above, sending you, in accordance with the relevant legislation, commercial electronic messages and other communications such as SMS, email, customer contact center / voice calls, electronic communication tools, and notifications via mobile channels.

**C-)**Transfer of Processed Personal Data

Your personal data may be shared by Paribu, in order to achieve the purposes set forth above, within the scope of the data processing conditions regulated under Article 5 of the Law and in compliance with the rules on the transfer of personal data set forth in the Law, with authorised official institutions and organisations, service-provider companies, suppliers, and our business partners located in Türkiye and abroad.

D-) Methods of Collection of Personal Data and Legal Grounds

Within the scope of your relationship with Paribu, your data are collected through fully or partially automated means, or through non-automated means provided that they are part of a data recording system, in physical and electronic environments, for the purpose of providing the aforementioned purposes and services within the framework set forth in Articles 5, 8, and 9 of the Law.

Your personal data are processed on the basis of the legal grounds set forth in Article 5 of the Law, namely "data processing being mandatory for the data controller to fulfil its legal obligation" and "explicit consent".

E-) Your Rights Regarding Your Personal Data

Within the scope of Article 11 of the Law, which "regulates the rights of the data subject", you have the following rights regarding your personal data;

• To learn whether personal data are being processed,
• If personal data have been processed, to request information about it,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data are transferred in Türkiye or abroad,
• To request the rectification of personal data if they have been processed incompletely or inaccurately,
• To request the deletion or destruction of personal data,
• To request that the rectification, deletion, or destruction of personal data be notified to the third parties to whom the personal data have been transferred,
• To object to the occurrence of a result against the person through the analysis of the processed data exclusively by automated systems,
• To request compensation for damages in case of being harmed due to the unlawful processing of personal data.

To exercise your rights within the scope of this article, you can choose one of the following methods to fill in the Personal Data Application Form on our website www.paribu.com and submit it to us in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller;

• By sending a petition or notarised mail to the address Huzur Mahallesi Maslak Ayazağa Caddesi Uniq İstanbul Sitesi B Blok No: 4B Sarıyer / İstanbul,
• By sending an email to [email protected] using your email address,
• By sending it via Registered Electronic Mail (KEP) to [email protected].

In-person applications made within this scope will be evaluated by us; depending on the nature of your requests, they will be concluded as soon as possible and at the latest within 30 days.

**PARİBU KRİPTO VARLIK A.Ş.**PRIVACY NOTICE ON COMMERCIAL ELECTRONIC MESSAGE CONSENT

In accordance with Article 10 of the Personal Data Protection Law No. 6698, titled "Disclosure Obligation of the Data Controller", published in Official Gazette No. 29677 dated 7 April 2016, which aims to protect the fundamental rights and freedoms of individuals — particularly the privacy of personal life — in the processing of personal data, and the Communiqué on Procedures and Principles to Be Followed in Fulfilling the Disclosure Obligation published in Official Gazette No. 30356 dated 10 March 2018, as Paribu Kripto Varlık Alım Satım Platformu A.Ş. (Paribu Crypto Asset Trading Platform Inc.) ("Paribu" or "Company"), we process your personal data within the scope of the Law No. 6563 on the Regulation of Electronic Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages. This privacy notice has been prepared to provide information on how we, as the data controller, process your personal data set forth below.

For detailed information on how we protect personal data and the rules with which we comply when processing personal data, you can also review our Personal Data Processing and Protection Policy on our website at www.paribu.com.

A-) What Personal Data of Yours Are Processed?

Within the scope of your relationship with Paribu, the following personal data are processed;

Identity Information: First name, last name.

Contact Information: Email, phone number.

B-) Purposes of Personal Data Processing

Personal data obtained within the scope of your relationship with Paribu are processed for the following purposes;

• Carrying out activities to promote Paribu and the products and services of Paribu and to increase recognition,
• Carrying out marketing, advertising, and promotional activities of Paribu and the products and services of Paribu,
• Conducting interviews to obtain feedback regarding comments/opinions and satisfaction in relation to Paribu and the products and services of Paribu, and the events and campaigns organised by Paribu,
• Within the scope of the data processing purposes set forth above, sending you, in accordance with the relevant legislation, commercial electronic messages and other communications such as SMS, email, customer contact center / voice calls, electronic communication tools, and notifications via mobile channels.

**C-)**Transfer of Processed Personal Data

Your personal data may be shared by Paribu, in order to achieve the purposes set forth above, within the scope of the data processing conditions regulated under Article 5 of the Law and in compliance with the rules on the transfer of personal data set forth in the Law, with authorised official institutions and organisations, service-provider companies, suppliers, and our business partners located in Türkiye and abroad.

D-) Methods of Collection of Personal Data and Legal Grounds

Within the scope of your relationship with Paribu, your data are collected through fully or partially automated means, or through non-automated means provided that they are part of a data recording system, in physical and electronic environments, for the purpose of providing the aforementioned purposes and services within the framework set forth in Articles 5, 8, and 9 of the Law.

Your personal data are processed on the basis of the legal grounds set forth in Article 5 of the Law, namely "data processing being mandatory for the data controller to fulfil its legal obligation" and "explicit consent".

E-) Your Rights Regarding Your Personal Data

Within the scope of Article 11 of the Law, which "regulates the rights of the data subject", you have the following rights regarding your personal data;

• To learn whether personal data are being processed,
• If personal data have been processed, to request information about it,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data are transferred in Türkiye or abroad,
• To request the rectification of personal data if they have been processed incompletely or inaccurately,
• To request the deletion or destruction of personal data,
• To request that the rectification, deletion, or destruction of personal data be notified to the third parties to whom the personal data have been transferred,
• To object to the occurrence of a result against the person through the analysis of the processed data exclusively by automated systems,
• To request compensation for damages in case of being harmed due to the unlawful processing of personal data.

To exercise your rights within the scope of this article, you can choose one of the following methods to fill in the Personal Data Application Form on our website www.paribu.com and submit it to us in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller;

• By sending a petition or notarised mail to the address Huzur Mahallesi Maslak Ayazağa Caddesi Uniq İstanbul Sitesi B Blok No: 4B Sarıyer / İstanbul,
• By sending an email to [email protected] using your email address,
• By sending it via Registered Electronic Mail (KEP) to [email protected].

In-person applications made within this scope will be evaluated by us; depending on the nature of your requests, they will be concluded as soon as possible and at the latest within 30 days.